6886 matches found
OpenClaw 代码问题漏洞
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.23 had code vulnerabilities. These vulnerabilities stemmed from the bundled plugin setup parser, which loaded setup-api.js from process.cwd. This allowed attackers to execute...
Unity Linux 20.1060e / 20.1070e Security Update: nodejs (UTSA-2026-017558)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017558 advisory. Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCII. The pointer p is read and...
Velocity.js has a Prototype Pollution vulnerability through #set path assignment
Summary A prototype pollution vulnerability was discovered in Velocity.js key = val. Because there is no validation or filtering to block sensitive keys such as \proto\, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype. PoC javascript...
PT-2026-41812
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=510792185 Crash type: Heap-use-after-free WRITE 4 Crash state: js atomics op js call c function JS CallInternal...
Nuclei 访问控制错误漏洞
Nuclei is a fast-customizable vulnerability scanner based on simple YAML, open-sourced by ProjectDiscovery. In versions 3.0.0 to 3.8.0 of Nuclei, there was an access control vulnerability. This vulnerability stemmed from the JavaScript protocol’s runtime feature, which allowed reading of local.js...
Prototype Pollution
Overview parse-ini is a Parse ini file to get the content and variables of the ini file as node object. Affected versions of this package are vulnerable to Prototype Pollution via the index.js file. An attacker can manipulate object properties and potentially execute arbitrary code or alter...
NPM: node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
NPM: node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js vulnerability discovered by ? in WordPress Npm node-ts-ocr versions 1.0.15...
GHSA-8JH2-3MW6-6PFM node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...
CVE-2025-63705
NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...
@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +78 more potentially affected by CVE-2026-44372 via nitro (>=3.0.0, <=3.0.260415-beta)
nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44372 Source advisory: SNYK:JS-NITRO-16757947...
CVE-2026-8032
CVE-2026-8032 affects PicoTronica e-Clinic Healthcare System ECHS (v5.7). In echs.js (path: /cdemos/echs/priv/echs.js), an argument manipulation of ADMIN_KEY leads to hard-coded credentials exposed in the remote-access component. The issue enables remote exploitation with a published exploit; imp...
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
Summary icu-minify's runtime formatter resolves select branches by looking up the runtime value as a plain property on a prototype-bearing object. When the value coerces to a key that exists on Object.prototype e.g. toString, proto, constructor, hasOwnProperty, valueOf, the lookup returns a truth...
8base-js-sdk (>=0.1.0, <=0.1.6), 8base-react-sdk (>=0.37.2, <=2.6.6) +438 more potentially affected by CVE-2026-42280 via auth0-js (>=8.11.3, <=9.32.0)
auth0-js NPM version =8.11.3, =0.1.0, =0.37.2, =0.37.2, =1.0.1, =0.0.5, =0.0.0, =0.1.0, =0.37.2, =0.37.2, =0.37.2, =0.37.2, =0.37.2, =0.0.1, =0.4.1, =0.4.1, =3.1.0-beta.0 and more Source cves: CVE-2026-42280 Source advisory: SNYK:JS-AUTH0JS-16438973...
8base-js-sdk (>=0.1.0, <=0.1.6), 8base-react-sdk (>=0.37.2, <=2.6.6) +438 more potentially affected by CVE-2026-42280 via auth0-js (>=8.11.3, <=9.32.0)
auth0-js NPM version =8.11.3, =0.1.0, =0.37.2, =0.37.2, =1.0.1, =0.0.5, =0.0.0, =0.1.0, =0.37.2, =0.37.2, =0.37.2, =0.37.2, =0.37.2, =0.0.1, =0.4.1, =0.4.1, =3.1.0-beta.0 and more Source cves: CVE-2026-42280 Source advisory: OSV:GHSA-8QJV-JJ2Q-X832...
NPM: Auth.js SDK has Improper Permission Checking
NPM: Auth.js SDK has Improper Permission Checking vulnerability discovered by ? in WordPress Npm auth0-js versions = 8.11.0, = 9.32.0...
GHSA-8QJV-JJ2Q-X832 Auth.js SDK has Improper Permission Checking
Description Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Am I Affected? Users are affected if they meet each of the following preconditions: - Applications built...
Exploit for Missing Authentication for Critical Function in Vitejs Vite
CVE-2026...
PT-2026-38263
Name of the Vulnerable Software and Affected Versions auth0-js versions 8.11.0 through 9.32.0 Description Improper validation in the Auth0.js SDK may allow the return of user profile data when a specifically crafted invalid ID token is used in conjunction with a valid access token. This issue...
NPM: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
NPM: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.23...
